During the decade of 2025, the cybersecurity landscape has drastically changed, with ransomware from a once isolated incident to a full-sized global crisis. No longer confined to isolated incidents, these attacks are now posing a tremendous threat to economies, governments, and public services across the globe.
There is a wide range of organizations across all sectors that find themselves exposed to increasingly sophisticated cyber threats, ranging from multinational corporations to hospitals to schools. It is reported in Cohesity’s Global Cyber Resilience Report that 69% of organizations have paid ransom demands to their suppliers in the past year, which indicates just how much pressure businesses have to deal with when such attacks happen.
The staggering number of cybercrime cases highlights the need for stronger cybersecurity measures, proactive threat mitigation strategies and a heightened focus on digital resilience. With cybercriminals continuously improving their tactics, organizations need to develop innovative security frameworks, increase their threat intelligence capabilities, and foster a culture of cyber vigilance to be able to combat this growing threat.
The cybersecurity landscape in 2025 has changed significantly, as ransomware has evolved into a global crisis of unprecedented proportions.
The threat of these attacks is not just limited to isolated incidents but has become a significant threat to governments, industries, and essential public services. Across the board, companies of all sizes are increasingly vulnerable to cyber threats, from multinational corporations to hospitals and schools.
In the last year, Cohesity released its Global Cyber Resilience Report, which revealed that 69% of organizations paid ransom demands, indicating the immense pressure that businesses face in the wake of such threats.
This staggering figure underscores how urgent it is that we take more aggressive cybersecurity measures, develop proactive threat mitigation strategies, and increase our emphasis on digital resilience to prevent cyberattacks from taking place.
Organizations must embrace new security frameworks, strengthen threat intelligence capabilities, and cultivate a culture of cyber vigilance to combat this growing threat as cybercriminals continue to refine their tactics. A persistent cybersecurity threat for decades, ransomware remains one of the biggest threats today.
However, the first global ransom payment exceeded $1 billion in 2023, marking a milestone that hasn't been achieved in many years.
Cyber extortion increased dramatically at this time, as cyber attackers constantly refined their tactics to maximize the financial gains that they could garner from their victims. The trend of cybercriminals developing increasingly sophisticated methods and exploiting vulnerabilities, as well as forcing organizations into compliance, has been on the rise for several years. However, recent data indicates a significant shift in this direction.
It is believed that in 2024, ransomware payments will decrease by a substantial 35%, mainly due to successful law enforcement operations and the improvement of cyber hygiene globally.
As a result of enhanced security measures, increased awareness, and a stronger collective resistance, victims of ransom attacks have become increasingly confident they can refuse ransom demands. However, cybercriminals are quick to adapt, altering their strategies quickly to counteract these evolving defences to stay on top of the game.
A response from them has been to increase their negotiation tactics, negotiating more quickly with victims, while simultaneously developing stealthier and more evasive ransomware strains to be more stealthy and evasive.
Organizations are striving to strengthen their resilience, but the ongoing battle between cybersecurity professionals and cybercriminals continues to shape the future of digital security. There has been a new era in ransomware attacks, characterized by cybercriminals leveraging artificial intelligence in increasingly sophisticated manners to carry out these attacks.
Using freely available AI-powered chatbots, malicious code is being generated, convincing phishing emails are being sent, and even deepfake videos are being created to entice individuals to divulge sensitive information or transfer funds by manipulating them into divulging sensitive information.
By making the barriers to entry much lower for cyber-attacking, even the least experienced threat actors are more likely to be able to launch highly effective cyber-attacks.
Nevertheless, artificial intelligence is not being used only by attackers to commit crimes.
There have been several cases where victims have attempted to craft the perfect response to a ransom negotiation using artificial intelligence-driven tools like ChatGPT, according to Sygnia's ransomware negotiation teams.
The limitations of AI become evident in high-stakes interactions with cybercriminals, even though they can be useful in many areas.
According to Cristal, Sygnia’s CEO, artificial intelligence lacks the emotional intelligence and nuance needed to successfully navigate these sensitive conversations. It has been observed that sometimes artificial intelligence-generated responses may unintentionally escalate a dispute by violating critical negotiation principles, such as not using negative language or refusing to pay outright.
It is clear from this that human expertise is crucial when it comes to managing cyber extortion scenarios, where psychological insight and strategic communication play a vital role in reducing the potential for damage. Earlier this year, the United Kingdom proposed banning ransomware payments, a move aimed at deterring cybercriminals by making critical industries less appealing targets for cybercriminals.
This proposed legislation would affect all public sector agencies, schools, local councils, and data centres, as well as critical national infrastructure.
By reducing the financial incentive for attackers, officials hope to decrease both the frequency and severity of ransomware incidents across the country to curb the number of ransomware incidents.
However, the problem extends beyond the UK. In addition to the sanctions issued by the Office of Foreign Assets Control, several ransomware groups that have links to Russia and North Korea have already been sanctioned. This has made it illegal for American businesses and individuals to pay ransoms to these organizations.
Even though ransomware is restricted in this manner, experts warn that outright bans are not a simple or universal solution to the problem.
As cybersecurity specialists Segal and Cristal point out, such bans remain uncertain in their effectiveness, since it has been shown that attacks fluctuate in response to policy changes, according to the experts. Even though some cybercriminals may be deterred by such policies, other cybercriminals may escalate their tactics, reverting to more aggressive threats or increasing their personal extortion tactics.
The Sygnia negotiation team continues to support the notion that ransom payments should be banned within government sectors because some ransomware groups are driven by geopolitical agendas, and these goals will be unaffected by payment restrictions. Even so, the Sygnia negotiation team believes that government institutions should not be able to make ransom payments because they are better able to handle financial losses than private companies.
Governments can afford a strong stance against paying ransoms, as Segal pointed out, however for businesses, especially small and micro-sized businesses, the consequences can be devastating if they fail to do so. It was noted in its policy proposal that the Home Office acknowledges this disparity, noting that smaller companies, often lacking ransomware insurance or access to recovery services, can have difficulty recovering from operational disruptions and reputational damage when they suffer from ransomware attacks.
Some companies could find it more difficult to resolve ransomware demands if they experience a prolonged cyberattack. This might lead to them opting for alternative, less transparent methods of doing so. This can include covert payment of ransoms through third parties or cryptocurrencies, allowing hackers to receive money anonymously and avoid legal consequences.
The risks associated with such actions, however, are considerable. If they are discovered, businesses can be subjected to government fines on top of the ransom, which can further worsen their financial situation.
Additionally, full compliance with the ban requires reporting incidents to authorities, which can pose a significant administrative burden to small businesses, especially those that are less accustomed to dealing with technology.
Businesses are facing many challenges in the wake of a ransomware ban, which is why experts believe a comprehensive approach is needed to support them in the aftermath of this ban.
Sygnia's Senior Vice President of Global Cyber Services, Amir Becker, stressed the importance of implementing strategic measures to mitigate the unintended consequences of any ransom payment ban.
It has been suggested that exemptions for critical infrastructure and the healthcare industries should be granted, since refusing to pay a ransom may lead to dire consequences, such as loss of life. Further, the government should offer incentives for organizations to strengthen their cybersecurity frameworks and response strategies by creating incentives like these.
A comprehensive financial and technical assistance program would be required to assist affected businesses in recovering without resorting to ransom payments. To address the growing ransomware threat effectively without disproportionately damaging small businesses and the broader economy, governments must adopt a balanced approach that entails enforcing stricter regulations while at the same time providing businesses with the resources they need to withstand cyberattacks.
